The Printcart Store plugin, used by online stores built on WordPress and WooCommerce, is affected by a flaw rated critical: 9.8 out of 10 according to the record published on November 7, 2026 by the NVD, the public vulnerability database run by NIST in the United States. If this plugin is installed on your site, we recommend having its version and advanced upload setting checked quickly.
What is it?
Under certain configurations, a site visitor, with no account or password, could upload a file of their choosing to the store’s server and have their own instructions executed there.
A custom products store accepts files from its customers, for example a logo to print on a t-shirt. “Upload” refers to sending a file to a site, and “server” refers to the computer that hosts the site and runs its programs. Normally, the site alone decides where to store the received file and in what form. Here, it is a bit like a convenience store letting the delivery driver choose where to drop off boxes, including behind the counter. The file can then end up somewhere other than the intended location, and the server may treat it as an instruction to execute rather than as an image. This is known as remote code execution.
Why is it serious?
The flaw is rated 9.8 out of 10 according to the NVD record, a score assigned by the reporting organization (CNA). No exploitation has been reported to date in this record.
Nothing indicates that an attack has occurred, and the record does not mention a public proof of concept, meaning a published technical demonstration showing that the flaw works. What carries weight is the rest: no password is required and the possible outcome is takeover of the site. For an organization in Quebec or Canada, this means a store going offline, payment pages that could be hijacked, and customers’ personal information exposed. In Quebec, the Act respecting the protection of personal information in the private sector requires organizations to keep a register of confidentiality incidents. In some cases, it also requires notifying the Commission d’accès à l’information (Quebec’s privacy regulator) and the individuals concerned. We view this as a management-level matter, not an IT ticket.
Who is affected?
All versions of the plugin up to and including 2.13.2, and only if an optional setting, inactive by default, has been switched to advanced mode.
The product in question is Printcart Store – Web to Print Product Designer for WooCommerce, from publisher printcart. The NVD record does not specify a fixed version. This plugin is used to design and order custom products online. Retailers, promotional products businesses, and custom workshops are among its possible users, though the records consulted do not break down usage by sector. Once the advanced option is active, still according to the record, the conditions needed are easy to meet for an anonymous visitor.
How do I check my business?
The question is whether the plugin is present, in which version, and whether the advanced setting is active.
- Have the list of installed plugins and the exact version of the Printcart module compiled, to compare against 2.13.2 (IT provider or site developer).
- Have it confirmed whether advanced upload mode is enabled (software vendor or site developer).
Scenario
Fictional example: a small custom apparel store using this plugin with advanced mode enabled.
The business sells embroidered t-shirts online. The customization plugin was installed two years ago, and advanced mode was turned on at the time to make logo uploads easier. One morning, the pages display unfamiliar content and the order form stops responding. The provider takes the site offline. Result: a day of lost sales, orders delayed at the workshop, customers to call back, and the contact details stored on the site now needing review.
What to do now
- Make a complete backup of the site and verify it can actually be restored.
- Disable the advanced upload option if it is active, pending a fixed version.
- Have the server logs, meaning the files where the computer hosting the site automatically records visits and operations, reviewed for anomalies.
- Install the fixed version as soon as the publisher releases one, after confirming it in their official documentation.
FAQ
Should we shut down our online store right away?
Not necessarily. Start by finding out whether the plugin is installed and whether this setting is active: the NVD record indicates the flaw is only exploitable in that configuration. If it is active and no fixed version is available, we consider disabling it with your provider preferable to a full shutdown.
How do we know if our site has already been affected?
Only a technical check can tell. Ask whoever manages your site to examine the folders where received files arrive and to review the server logs. No inspection provides certainty: there is no absolute protection, and be wary of any claim promising zero risk. If there is any doubt involving personal information, document the event in your incident register.
Are we too small to interest an attacker?
Size is not a protection. Generally speaking, automated tools scan the Web to find sites running a vulnerable plugin, without targeting any particular organization. This general pattern does not describe this vulnerability, whose NVD record reports no exploitation to date. The Canadian Centre for Cyber Security publishes baseline controls for small and medium organizations, and applying them significantly reduces exposure.
Sources
- CVE-2026-19803 record from the National Vulnerability Database · NIST, November 7, 2026
- Canadian Centre for Cyber Security: baseline cyber security controls for small and medium organizations · reference control checklist
- Commission d’accès à l’information du Québec · obligations, incident register, and notification
Source: NVD (NIST) · https://nvd.nist.gov/vuln/detail/CVE-2026-19803
Article prepared by RISS Canada’s monitoring team from the public sources cited above, with the assistance of artificial intelligence tools, then reviewed according to our editorial standards.
